Transition Technology: Ticket #484: Puffin/Aegir SSL options

hours, totalhours changed

chris — Tue, 29 Jan 2013 09:07:47 GMT

hours changed from 0.0 to 0.1
totalhours changed from 0.0 to 0.1

Replying to jim:

Best option?: Use extra config with new "/data/conf/override.global.inc/" file
(SLOW) Drupal module: Carry on using 443 Session
What do you think is best, Chris? My vote is for 3, with 4 as backup...

is simply redirecting some http URLs to https, it won't ensure that all authentication cookies are secure, 4. does what is needed, why do you think it's slow?

jim — Tue, 29 Jan 2013 19:23:42 GMT

4 would be slower than the other options because 3) happens when settings.php (and the global.inc, then override.global.inc) are loaded very early in Drupal's bootstrap. 4 needs a module, which requires lots more files to be loaded and run before the relevant hooks are run.

I've added Session 443 back to the platform, and we'll go with that (option 4).

The code required in our tn.org settings.php looks like this:

# chris
# https://www.transitionnetwork.org/admin/help/session443
  if (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] != 'off') {
    ini_set('session.cookie_secure', 1);
  }

Which is simple, but I see this commit referring to issues with Drupal e-commmerce stuff: http://drupalcode.org/project/barracuda.git/commit/dfa3536 -- not a problem now, but when the Transition Network shop opens we would need to have a better alternative.

Since ticket:487#comment:2 needs me to add some code to override.global.inc, I can probably add this at the same time.

chris — Tue, 29 Jan 2013 19:58:10 GMT

Replying to jim:

I've added Session 443 back to the platform

Thanks, the secure flag does need setting on the authentication cookie.

jim — Tue, 29 Jan 2013 20:55:45 GMT

Replying to chris:

I've added Session 443 back to the platform

Thanks, the secure flag does need setting on the authentication cookie.

Per ticket:487#comment:3, I've now set this for all our sites on all platforms via /data/conf/override.global.php

status changed; resolution set

jim — Tue, 29 Jan 2013 23:33:00 GMT

status changed from new to closed
resolution set to fixed

SSL works now...

Cert is correct
Redirects to HTTPS in login/logged in and other important pages
Works like current site as far as my tests show: forces HTTPS when logged in, and not when not.

Note due to way settings.php is set up, the warning on Drupal's status page shows despite my work over on #487:

443 Session settings.php Settings.php is not setup correctly. With the current configuration of 443 Session module, the following lines must be in settings.php.

if (!empty($_SERVERHTTPS?) && $_SERVERHTTPS? != 'off') {

ini_set('session.cookie_secure', 1);

}

}

The above is caused by the module dumbly scanning settings.php with a regexp in session443_requirements() in its .install file. I've raised a ticket on Drupal.org.

Closing this for now, unless Chris wants to add anything?